JuanMa JWT Auth Pro

Unlike basic JWT plugins that use single long-lived tokens, JWT Auth Pro implements modern OAuth 2.0 security best practices with short-lived access tokens and secure refresh tokens.

Why JWT Auth Pro?

The Problem with Basic JWT Plugins:
* Long-lived tokens (24h+) = Higher security risk
* No refresh mechanism = Tokens live until expiry
* XSS vulnerable = Tokens stored in localStorage
* No revocation = Can’t invalidate compromised tokens

JWT Auth Pro Solution:
* Short-lived access tokens (1h default) = Minimal attack window
* Secure refresh tokens = HTTP-only cookies, XSS protected
* Automatic token rotation = Fresh tokens on each refresh
* Complete session control = Revoke any user session instantly

Features

• Simple JWT Authentication – Clean, stateless token-based auth
• HTTPOnly Refresh Tokens – Secure refresh tokens in HTTP-only cookies
• Token Rotation – Automatic refresh token rotation for enhanced security
• CORS Support – Proper cross-origin request handling
• Clean Admin Interface – Simple configuration in WordPress admin
• Developer Friendly – Clear endpoints and documentation

Security Comparison

Feature
Basic JWT Plugins
JWT Auth Pro

Token Lifetime
Long (hours/days)
Short (1 hour)

Refresh Tokens
None
Secure HTTP-only

XSS Protection
Limited
HTTP-only cookies

Token Revocation
Manual only
Automatic rotation

Session Management
None
Database tracking

Security Metadata
None
IP + User Agent

Perfect for:

• Single Page Applications (React, Vue, Angular)
• Mobile Applications (iOS, Android)
• API Integrations (Third-party services)
• Headless WordPress (Decoupled architecture)

API Endpoints

• POST /wp-json/jwt/v1/token – Login and get access token
• POST /wp-json/jwt/v1/refresh – Refresh access token
• GET /wp-json/jwt/v1/verify – Verify token and get user info
• POST /wp-json/jwt/v1/logout – Logout and revoke refresh token

Security

• Stateless Authentication – JWT tokens contain all necessary information
• HTTPOnly Cookies – Refresh tokens stored securely, inaccessible to JavaScript
• Token Rotation – Refresh tokens automatically rotate on use
• Configurable Expiration – Set custom expiration times
• IP & User Agent Tracking – Additional security metadata

Support

For support and documentation, visit: https://github.com/juanma-wp/jwt-auth-pro-wp-rest-api

Privacy Policy

This plugin stores user session data including IP addresses and user agent strings for security purposes. This data is used solely for authentication and security monitoring.